I'm no expert, but rather than watching attacks for three years and then issuing some ineffectual reports and sanctions, wouldn't it have been better to just lock down the damn power plants? If you're smart enough to notice all this nefarious activity and correctly attribute it to somebody on the other side of the globe even though we know that other parties use all the same tools they use, why aren't you smart enough to just fix the vulnerabilities they're using? Curious!